Dataverse - Login from IP not in the allow list

Back


Id	81c693fe-f6c4-4352-bc10-3526f6e22637
Rulename	Dataverse - Login from IP not in the allow list
Description	Identifies logons from IPv4 addresses not matching IPv4 subnets maintained on an allow list. This analytics rule uses the NetworkAddresses watchlist template.
Severity	High
Tactics	InitialAccess
Techniques	T1078 T1190 T1133
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Login from IP not in the allow list.yaml
Version	3.2.0
Arm template	81c693fe-f6c4-4352-bc10-3526f6e22637.json

KQL

// Use static IP address or CIDR list specified in the
// NetworkAddresses watchlist template with tag "AllowDataverse"
let allowed_networks = MSBizAppsNetworkAddresses()
    | where Tags has "AllowDataverse"
    | summarize by IPSubnet;
let query_frequency = 1h;
let watchlist_entries_count = toscalar (allowed_networks
    | summarize count());
let dataverse_signin_activity = materialize(
    DataverseActivity
    | where watchlist_entries_count > 0
    | where TimeGenerated >= ago (query_frequency)
    | where Message == "UserSignIn" and isnotempty(ClientIp)
    | summarize FirstEvent = arg_min(TimeGenerated, *) by UserId, ClientIp, InstanceUrl
    );
let authorized_ip_addresses = dataverse_signin_activity
    | evaluate ipv4_lookup(allowed_networks, ClientIp, IPSubnet);
dataverse_signin_activity
| join kind=leftanti(authorized_ip_addresses) on ClientIp
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    FirstEvent,
    UserId,
    ClientIp,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Login from IP not in the allow list.yaml
alertDetailsOverride:
  alertDisplayNameFormat: 'Dataverse - Login from IP not on the allow list in {{InstanceUrl}} '
  alertDescriptionFormat: Sign-in activity detected in {{InstanceUrl}} from an IP {{ClientIp}} not on the allow list.
query: |
  // Use static IP address or CIDR list specified in the
  // NetworkAddresses watchlist template with tag "AllowDataverse"
  let allowed_networks = MSBizAppsNetworkAddresses()
      | where Tags has "AllowDataverse"
      | summarize by IPSubnet;
  let query_frequency = 1h;
  let watchlist_entries_count = toscalar (allowed_networks
      | summarize count());
  let dataverse_signin_activity = materialize(
      DataverseActivity
      | where watchlist_entries_count > 0
      | where TimeGenerated >= ago (query_frequency)
      | where Message == "UserSignIn" and isnotempty(ClientIp)
      | summarize FirstEvent = arg_min(TimeGenerated, *) by UserId, ClientIp, InstanceUrl
      );
  let authorized_ip_addresses = dataverse_signin_activity
      | evaluate ipv4_lookup(allowed_networks, ClientIp, IPSubnet);
  dataverse_signin_activity
  | join kind=leftanti(authorized_ip_addresses) on ClientIp
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      FirstEvent,
      UserId,
      ClientIp,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
relevantTechniques:
- T1078
- T1190
- T1133
kind: Scheduled
name: Dataverse - Login from IP not in the allow list
tactics:
- InitialAccess
severity: High
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: ClientIp
  entityType: IP
- fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
  entityType: CloudApplication
queryFrequency: 1h
description: Identifies logons from IPv4 addresses not matching IPv4 subnets maintained on an allow list. This analytics rule uses the NetworkAddresses watchlist template.
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
triggerOperator: gt
version: 3.2.0
queryPeriod: 1d
id: 81c693fe-f6c4-4352-bc10-3526f6e22637

ARM